WordPress Custom Field Suite Plugin <= 2.6.7 is vulnerable to SQL Injection

Software Custom Field Suite Type Plugin Vulnerable versions = 2.6.7 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-3561 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 5e99e2eccc53 Credits Jack Taylor Required privilege Contributor...

WordPress Wheel of Life Plugin <= 1.1.7 is vulnerable to Broken Access Control

Software Wheel of Life Type Plugin Vulnerable versions = 1.1.7 Fixed in 1.1.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3627 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 68abc18dc3c6 Credits Lucio Sá Required privilege...

WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Arbitrary File Upload

Software Pexels: Free Stock Photos Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-6132 Patch priority Medium CVSS severity Medium 8.8 Developer Claim ownership PSID 042650894638 Credits István Márton Required...

WordPress Media Library Assistant Plugin <= 3.16 is vulnerable to SQL Injection

Software Media Library Assistant Type Plugin Vulnerable versions = 3.16 Fixed in 3.17 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-5605 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID a2ffbb62fd66 Credits Krzysztof Zając Required privilege Contribut...

WordPress Word Balloon Plugin <= 4.21.1 is vulnerable to Local File Inclusion

Software Word Balloon Type Plugin Vulnerable versions = 4.21.1 Fixed in 4.22.0 OWASP Top 10 A6: Security Misconfiguration Classification Local File Inclusion CVE CVE-2024-35781 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2b66b1bcd514 Credits João Pedro S Alcântara...

WordPress Materialis Theme <= 1.1.24 is vulnerable to Broken Access Control

Software Materialis Type Theme Vulnerable versions = 1.1.24 Fixed in 1.1.30 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-3204 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e1b70e9d38bc Credits Gibran Abdillah Required privilege...

WordPress Lifeline Donation Plugin <= 1.2.6 is vulnerable to Broken Authentication

Software Lifeline Donation Type Plugin Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Authentication CVE CVE-2024-5432 Patch priority High CVSS severity High 10 Developer Claim ownership PSID c4cb49e164b6 Credits István Márton Required...

WordPress Master Slider Plugin <= 3.9.10 is vulnerable to Cross Site Request Forgery (CSRF)

Software Master Slider Type Plugin Vulnerable versions = 3.9.10 Fixed in 3.10.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-50900 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e2a39371f6f9 Credits LVT-tholv2k Require...

WordPress WP Magazine Modules Lite Plugin <= 1.1.2 is vulnerable to Local File Inclusion

Software WP Magazine Modules Lite Type Plugin Vulnerable versions = 1.1.2 Fixed in 1.1.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-5574 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 60f52a06449e Credits stealthcopter Required privilege...

WordPress WPPizza Plugin <= 3.18.13 is vulnerable to Cross Site Scripting (XSS)

Software WPPizza Type Plugin Vulnerable versions = 3.18.13 Fixed in 3.18.14 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35766 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5804edc2828f Credits Dimas Maulana Required privilege...

WordPress Photo Video Gallery Master Plugin <= 1.5.3 is vulnerable to PHP Object Injection

Software Photo Video Gallery Master Type Plugin Vulnerable versions = 1.5.3 Fixed in N/A OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-5724 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 22871a87af76 Credits Francesco Carlucci Required...

WordPress Squeeze Plugin <= 1.4 is vulnerable to Arbitrary File Upload

Software Squeeze Type Plugin Vulnerable versions = 1.4 Fixed in 1.4.1 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-35767 Patch priority Low CVSS severity Low 9.1 Developer Claim ownership PSID 475c5115f4ba Credits YCInfosec Required privilege Administrator Publishe...

WordPress WordPress Picture / Portfolio / Media Gallery Plugin <= 3.0.1 is vulnerable to Server Side Request Forgery (SSRF)

Software WordPress Picture / Portfolio / Media Gallery Type Plugin Vulnerable versions = 3.0.1 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-5021 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID 4f6e62e03ba9 Credits...

WordPress Sirv Plugin <= 7.2.6 is vulnerable to Arbitrary File Upload

Software Sirv Type Plugin Vulnerable versions = 7.2.6 Fixed in 7.2.7 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-5853 Patch priority Medium CVSS severity Medium 9.9 Developer Sirv PSID b8d1b016bf81 Credits Lucio Sá Required privilege Contributor Published 18 June,...

WordPress Ali2Woo Lite Plugin <= 3.3.6 is vulnerable to Broken Access Control

Software Ali2Woo Lite Type Plugin Vulnerable versions = 3.3.6 Fixed in 3.3.7 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-4450 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID f7ad6ff2580e Credits Lucio Sá Required privilege...

WordPress Salon booking system Plugin <= 10.2 is vulnerable to Arbitrary File Upload

Software Salon booking system Type Plugin Vulnerable versions = 10.2 Fixed in 10.3 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-3229 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 73c749725728 Credits Gibran Abdillah Required privilege...

WordPress Custom Product List Table Plugin <= 3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Custom Product List Table Type Plugin Vulnerable versions = 3.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-4541 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 880a62dd6058 Credits Benedictus...

WordPress Scheduling Plugin – Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Broken Access Control

Software Scheduling Plugin – Online Booking for WordPress Type Plugin Vulnerable versions = 3.5.10 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1634 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 166eecf10900...

WordPress Serious Slider Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software Serious Slider Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35762 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 57f1f13032c5 Credits Steven Julian Required privilege Editor...

WordPress Tickera Plugin <= 3.5.2.8 is vulnerable to Broken Access Control

Software Tickera Type Plugin Vulnerable versions = 3.5.2.8 Fixed in 3.5.2.9 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-5860 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 94f597cb32e8 Credits Lucio Sá Required privilege...